feat: 支持纯 FastAPI 模式（根路径服务前端）+ 修任务端点路径

- web/app.py：create_app(api_prefix=) 参数化前缀——'' 即根路径模式，
  87 条路由直接服务前端使用的路径，无需 Flask 兜底
- web/main.py：WEB_MODE=dual（默认，迁移期）/ fastapi（纯 FastAPI）切换
- 修真实路径缺陷：任务类端点漏了 /api 段（Flask 为 /api/topen 等，
  原写成 /topen），根路径模式下前端会 404。已改为 /api/topen、/api/queue、
  /api/batch_progress、/api/task/*；fe_error 同步修正
- 奇偶校验路径映射同步更新

验证：
- tests/test_root_mode.py 新增 66 项：前端调用的每条路径在纯 FastAPI 模式下
  均非 404；root 模式不再暴露 /api/v1
- 纯 FastAPI 模式真实启动（uvicorn, PORT=5002）实测：
  /health、/、/static 200，/song、/api/task/list 401（鉴权生效）
- 全套 pytest 135/135；ruff All checks passed；pyright 0 errors；奇偶 36/36

tests/test_root_mode.py

@@ -0,0 +1,67 @@
+# -*- coding: utf-8 -*-
+"""纯 FastAPI 模式（api_prefix=''）测试：前端全部路径由 FastAPI 服务。"""
+import warnings
+
+import pytest
+from fastapi.testclient import TestClient
+
+warnings.filterwarnings('ignore')
+
+# 前端实际调用的路径（从 index.html / site_auth.js 抽取的代表集合）
+FRONTEND_PATHS = [
+    '/', '/health', '/api/info', '/song', '/search', '/playlist', '/album',
+    '/toplist', '/artist_songs', '/comments',
+    '/auth/me', '/auth/login', '/auth/logout', '/auth/heartbeat', '/auth/register',
+    '/auth/send_code', '/auth/redeem', '/auth/forgot_password', '/auth/ann_seen',
+    '/auth/admin_login/email', '/auth/admin_login/verify',
+    '/user/status', '/user/logout', '/user/qr/create', '/user/qr/check',
+    '/user/playlists', '/user/playlist', '/user/collect', '/user/comment',
+    '/account/vip', '/global/playlists', '/global/playlist', '/api/playlist/play',
+    '/download', '/download/batch_zip', '/download/result', '/download/batch_zip/result',
+    '/podcast/parse', '/podcast/programs', '/podcast/search', '/podcast/hot',
+    '/podcast/download', '/podcast/download/batch_zip',
+    '/api/topen', '/api/queue', '/api/batch_progress', '/api/task/cancel',
+    '/api/task/heartbeat', '/api/task/list', '/api/fe_error', '/audio_stream',
+    '/admin/qr/create', '/admin/qr/check', '/admin/cookie/status', '/admin/cookie/delete',
+    '/admin/logs', '/admin/site/users', '/admin/site/logs', '/admin/site/cards/list',
+    '/admin/site/ann/get', '/admin/site/play_key/get', '/admin/site/backup/list',
+    '/admin/site/smtp/get', '/admin/site/user/cookie',
+]
+
+
+@pytest.fixture()
+def root_client(tmp_path, monkeypatch):
+    """root 模式应用（不挂 Flask 兜底、前缀为空）。"""
+    import auth_system as auth
+    import core.db as db
+
+    monkeypatch.setattr(auth, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(auth, 'DB_PATH', tmp_path / 'site.db')
+    monkeypatch.setattr(auth, 'BACKUP_DIR', tmp_path / 'backups')
+    monkeypatch.setattr(auth, 'SECRET_KEY_PATH', tmp_path / 'secret.key')
+    monkeypatch.setattr(db, 'DATA_DIR', tmp_path)
+    monkeypatch.setattr(db, 'DB_PATH', tmp_path / 'site.db')
+    auth.init_db()
+    monkeypatch.setattr('web.deps.secret_key', lambda: 'root-mode-secret')
+
+    from web.app import create_app
+    return TestClient(create_app(api_prefix=''))
+
+
+@pytest.mark.parametrize('path', FRONTEND_PATHS)
+def test_frontend_path_not_404(root_client, path):
+    """前端调用的每条路径都必须有 FastAPI 路由（不得 404）。"""
+    r = root_client.post(path, json={})
+    assert r.status_code != 404, f'{path} 在纯 FastAPI 模式下 404'
+
+
+def test_root_page_served(root_client):
+    r = root_client.get('/')
+    assert r.status_code == 200
+    assert r.headers.get('cache-control', '').startswith('no-cache')
+
+
+def test_no_api_v1_prefix_in_root_mode(root_client):
+    """root 模式下不再暴露 /api/v1 前缀（避免与 Flask 时代语义混淆）。"""
+    r = root_client.post('/api/v1/song', json={})
+    assert r.status_code == 404